Add Intrusion Detection System (IDS) policies

You can use Intrusion Detection System (IDS) policies to monitor, identify, and log traffic for known threats.

To help inform how you manage your Firewall, for example, to block traffic using the source IP address, you can:

• Get Intrusion System Monitor alerts.
• View the information collected using the IDS logs.

Before you begin

1. Check the built-in Intrusion policies and set up custom Intrusion policies if needed.
2. Decide whether to log IDS data for the IDS logs:
   1. Go to Services > Intrusion system > Signatures.
   2. Select the Use syslog for Intrusion logging checkbox.
   3. Select Save.

Turn IDS on or off

You can choose whether to have IDS on, to record logs and send you alerts on intrusion threats.

1. Go to Services > Intrusion system > IDS.
2. Select the Enabled checkbox to turn IDS on.
3. Select Save changes.

Create an IDS policy

1. Select Add new IDS policy.
2. Ensure Enabled is selected.
3. Select the Interface to apply the policy to:
   • All internal interfaces
   • All external interfaces
   • Select a specific interface
4. For Policy, select one or more policies.
5. (Optional) Enter a Comment.
6. Select Add.

Edit IDS polices

To edit policies:

1. Hover over the policy.
2. Select Edit. 
3. Change any fields as needed.
4. Select Save changes.

To have the policy not apply, but keep it in the list:

1. Hover over the policy.
2. Select Edit. 
3. Clear the Enabled checkbox.
4. Select Save changes.

Delete IDS policies

To delete a single policy:

1. Hover over the policy.
2. Select Delete. 

To delete multiple policies:

1. Select the checkbox:
   • Next to the Interface column to select all objects.
   • Next to each row.
2. Select the Delete button.